Patch #39999 ยป 0001-Explicitly-render-a-404-on-non-JS-requests-to-messag.patch
| app/controllers/messages_controller.rb | ||
|---|---|---|
| 125 | 125 |
@content = +"#{ll(Setting.default_language, :text_user_wrote_in, {:value => @message.author, :link => "message##{@message.id}"})}\n> "
|
| 126 | 126 |
end |
| 127 | 127 |
@content << @message.content.to_s.strip.gsub(%r{<pre>(.*?)</pre>}m, '[...]').gsub(/(\r?\n|\r\n?)/, "\n> ") + "\n\n"
|
| 128 | ||
| 129 |
respond_to do |format| |
|
| 130 |
format.html { render_404 }
|
|
| 131 |
format.js |
|
| 132 |
end |
|
| 128 | 133 |
end |
| 129 | 134 | |
| 130 | 135 |
def preview |
| test/functional/messages_controller_test.rb | ||
|---|---|---|
| 311 | 311 |
assert_include '> An other reply', response.body |
| 312 | 312 |
end |
| 313 | 313 | |
| 314 |
def test_quote_as_html_should_respond_with_404 |
|
| 315 |
@request.session[:user_id] = 2 |
|
| 316 |
get( |
|
| 317 |
:quote, |
|
| 318 |
:params => {
|
|
| 319 |
:board_id => 1, |
|
| 320 |
:id => 3 |
|
| 321 |
}, |
|
| 322 |
) |
|
| 323 | ||
| 324 |
assert_response 404 |
|
| 325 |
end |
|
| 326 | ||
| 314 | 327 |
def test_preview_new |
| 315 | 328 |
@request.session[:user_id] = 2 |
| 316 | 329 |
post( |